CCPA Privacy Statement
and Job Applicant Privacy Notice

Effective Date: January 1, 2021

This CCPA Privacy Statement and Job Applicant Privacy Notice (the “Notice”) applies solely to job applicants, employees, owners, directors, officers, and contractors who reside in the State of California (collectively referred to in this Notice as “you” or “your” or “person”). QuoteLab, LLC, which does business as MediaAlpha, (referred to in this Notice as “we”, “us”, “our”, or “MediaAlpha”) adopts this Notice to comply with the California Consumer Privacy Act of 2018 (which we refer to as “CCPA”). Please note any terms defined in the CCPA have the same meaning when used in this Notice. For example, “personal information” has the meaning defined in the CCPA but excludes information exempted from the CCPA’s scope.

KINDLY NOTE, CALIFORNIA LAW REQUIRES THAT WE PROVIDE YOU THIS NOTICE ABOUT THE COLLECTION AND USE OF YOUR PERSONAL INFORMATION. PLEASE READ IT CAREFULLY. UPON REQUEST, THIS NOTICE CAN BE MADE AVAILABLE IN ALTERNATIVE FORMATS (E.G., LARGE PRINT, AUDIO, ETC.). PLEASE CONTACT PEOPLEOPS@MEDIAALPHA TO REQUEST AN ALTERNATIVE FORMAT IF NEEDED SO YOU CAN ACCESS THE INFORMATION IN THIS NOTICE.

This Notice sets forth the categories of personal information we collect and use from you and the purposes for which we use that information.

This Notice does not create or form part of any contract for employment or otherwise.

I. Categories of Personal Information We Collect

When a person applies to join our team or over the course of a person’s employment, we may collect the following categories of personal information.

Providing any personal information to us is voluntary. If, however, you do not provide sufficient information, we may be unable to consider your application or, if you are hired, your subsequent promotion, transfer, or relocation.

In certain cases, we may ask you for additional information for purposes of complying with applicable laws, rules, and regulations.

Contact information, such as email address, telephone or mobile phone number, and home or postal address;
Biographical information, such as name, alias and other names, gender, date of birth, marital or domestic partner status, Social Security Number, driver’s license number or state ID card number, passport number, and other unique personal identifiers associated with you or other beneficiaries such as your spouse or child; classifications protected under state or federal Equal Employment Opportunity laws (such as race or national origin), medical condition or information, and health insurance information and policy number;
Job application information and materials and any information provided to recruiters, such as your job application, resume or CV, cover letter, references, education history, work history, whether you are subject to prior employer obligations;
Immigration status and other information that would allow us to verify your employment eligibility;
Information needed to understand and assess accommodation requests regarding potential disabilities or other health conditions;
Website use information, and sign-in and device information, such as username and password, account name or number, and other online or device identifiers, Internet or other electronic network activity information such as browsing and search history and information regarding interactions with websites and applications, our systems, and networks (to learn more about the information we collect automatically on MediaAlpha websites (like Join Our Team and Careers) read Information We Collect Automatically and Cookies and Technologies and to learn how our jobs board website partner handles your information (collectively the foregoing are referred to as our “job applicant and recruitment websites”) read our partner’s privacy policy);
Educational, professional, and employment history, such as current employment, previous employment, educational institutions attended and rewards, certificates, and degrees achieved;
Professional qualifications, such as licenses, permits, memberships, and certifications;
References, such as reference name, title, and contact information, association or relationship with you, and any information that the reference provides about you;
Job preferences, such as desired position and compensation, location preferences and willingness to relocate;
Information from the application process, such as any phone-screens, interviews, evaluations and outcomes of any tests and other recruiting exercises;
Geolocation data, including badge access and telematics data;
Biometric information, including imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, or voice recordings and keystroke patterns or rhythms, gait patterns or rhythms, and other characteristics that can be used to establish identity; and
Financial information, including bank account, billing address, and information about your income and account balances;
Background check information, such as information necessary to complete background, credit, and/or other checks (like criminal records) when permitted by law, and information received during these checks; and
Other information you provide to us, including any other information you make publicly available through job search or career networking sites.

II. Sources of Personal Information

We collect personal information from you when you apply for a job and throughout the job application or recruitment process. We may also collect your personal information from other sources and combine it with the personal information you provide us. For example, we may collect your personal information from:

Job board websites, such as those you use to search our job openings or that you use to apply for a job with us;
Prior employers, who provide us with employment references;
Professional references, that you authorize us to contact and who provide us information about you;
Pre-employment screening services, such as background check providers (where permitted by law);
Employment agencies and recruiters;
Your educational institutions;
Your public social media profile or other publicly available sources;
Online activity, collected by us or our service providers, partners, contractors, or vendors, such as information collected using cookies and other similar technologies (to learn more about the information we collect automatically on MediaAlpha websites (like Join Our Team and Careers) read Information We Collect Automatically and Cookies and Technologies and to learn how our jobs board website partner handles your information (collectively the foregoing are referred to as our “job applicant and recruitment websites”) read our partner’s privacy policy); and
Our personnel.

II. How We Use and Share Your Personal Information

(a) Purposes for Which We Use Personal Information.

We may use the personal information detailed above for the following purposes:

Managing Recruitment, such as the following:
- operating our job and recruitment websites which reference, link to, or post this Notice;
- recruiting, interviewing, and evaluating your application, employment, or performance of services with us;
- determining your eligibility for a position with the company, such as processing your application, assessing your fit with us or for a specific role, conducting interviews, and keeping records related to our hiring process;
- conducting background checks and other pre-employment screening (where permitted by law);
- analyzing and improving our job and recruitment websites and our application and recruitment processes and activities;
- accommodating disabilities or health conditions;
- communicating with you regarding your application, opportunities with MediaAlpha, or about the job and recruitment websites and any changes to applicable terms or policies;
- responding to your inquiries; and
- other business operations.
Managing Employment, such as the following:
- Managing compensation, benefits, and employment-related expenses, such as payroll processing, managing salaries and expenses, managing corporate credit cards and expense reimbursements, as well as administering equity, compensation, bonus, and insurance programs;
- Managing professional development, performance, and conduct, such as responding to complaints of misconduct, managing conflicts of interest, conducting performance appraisals, supporting career development, and managing whistleblower programs;
- Complying with our legal obligations, such as those related to tax and anti-discrimination laws;
- Responding to requests, inquiries, and complaints; and
- Other routine business purposes.
Managing Compliance, Safety, and Fraud Prevention, such as the following:
- Protecting the company against illegal activity and other misconduct, such as by detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
- undertaking activities to verify and maintain the quality, safety, and performance of our products and services, including product and service testing, research, and development;
- complying with internal policies and procedures;
- investigating and deterring against fraudulent, harmful, unauthorized, unethical or illegal activity, or conduct in violation of our policies or procedures;
- complying with lawful requests and legal process, such as responding to subpoenas or requests from government or supervisory authorities;
- sharing information with government authorities, law enforcement, courts or private parties where we have a good-faith belief it is necessary for the foregoing purposes;
- Complying with or monitoring compliance with legal obligations and other requirements, such as those related to equal opportunities, employment, safety, fraud, tax, and anti-discrimination laws;
- protecting our, your, or others’ rights, safety, and property;
- Responding to your inquiries; and
- Other routine business purposes.
Conducting Analytics, such as the following:
- Creating anonymous, aggregated, or de-identified data that we use and share to analyze, understand, and improve the use of our job and recruitment websites, our application and recruitment activities, our business and products, and for other lawful business purposes.

(b) How We Share Personal Information.

We may share your personal information with other parties as necessary for the purposes described above including with:

Affiliates, including our corporate parent, subsidiaries, and other affiliates under the control or reasonable control of our corporate parent, for purposes consistent with this Notice or to operate shared infrastructure, systems, and technology;
Service providers, vendors, contractors, consultants, and professional advisors, such as companies that provide us with services that help us manage the recruiting process and operate our business, such as job boards, recruiters, interviewing and testing, virtual meeting software and service providers, pre-employment screening, interview travel booking and expense reimbursement (where applicable), relocation (where applicable), and recruitment analytics, and those that provide legal services (such as lawyers), immigration services and advisors, and other outside professional advisors;
Government authorities, law enforcement, and others, such as government authorities, law enforcement, courts, and others as described in the Managing Compliance, Safety, and Fraud Prevention section above;
Business transfers, including parties to transactions and potential transactions whereby we sell, transfer, or otherwise share some or all of our business or assets, including your personal information, such as part of a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution; and
Customers and business partners, including our customers, other companies, and individuals with whom we do business or with which we are exploring a business relationship.

III. Retention Periods

We store your Personal Information strictly and to the extent necessary for the performance of our obligations, and strictly for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable laws, rules, and regulations. When we no longer need to use your personal information, we will remove it from our systems and records and/or take steps to properly render it unintelligible, so that you can no longer be identified from it (unless we need to keep your personal information to comply with legal or regulatory obligations to which we are subject).

IV. Your Rights

If you have declared your consent regarding certain types of processing activities, you can withdraw this consent at any time with future effect. This withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. To the extent you’ve provided your consent and wish to withdraw it, you can contact us as stated in Section VII below.

Pursuant to applicable law you may also have the right to: (1) request access to the personal information we have collected about you; (2) request rectification of your personal information; (3) request erasure of your personal information; (4) request restriction of processing of your personal information; (5) request data portability of your personal information; and/or (6) object to the processing of your personal information. Please note that these rights might be limited under the applicable laws, rules, or regulations.

Right of access: In certain circumstances, as provided by applicable law, you have the right to obtain from us confirmation as to whether or not personal information concerning you is processed, and, where that is the case, to request access to such personal information. The access information includes –among other things – the purposes of the processing, the categories of personal information concerned, the recipients or categories of recipients to whom the personal information have been or will be disclosed, the sources of the personal information, the duration of retention, and the technical security measures put in place to safeguard the personal information in case of transfer across borders. However, this is not an absolute right and the interests of other individuals may restrict your right of access. You may also have the right to obtain a copy of the personal information. For additional copies requested by you, we may charge a reasonable fee based on administrative costs.
Right to rectification: In certain circumstances, as provided by applicable law, you have the right to obtain from us the rectification (i.e., correction) of inaccurate personal information concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal information completed, including by means of providing a supplementary statement.
Right to erasure (right to be forgotten): In certain circumstances, as provided by applicable law, you have the right to obtain from us the erasure of personal information concerning you. In those cases, we will to erase, or render permanently unintelligible, that personal information.
Right to restriction of processing: In certain circumstances, as provided by applicable law, you have the right to obtain from us restriction of processing of your personal information. In this case, the respective data will be marked and may only be processed by us for certain purposes. As we, however, process and use your personal information primarily for purposes of carrying out the our job, recruitment, employment, and other professional relationship with you (as applicable), we will in principle have a legitimate interest for the processing which will override your restriction request, unless the restriction request relates to marketing activities (which generally do not apply in the employment context).
Right to data portability: In certain circumstances, as provided by applicable law, you have the right to receive the personal information about you that you have provided to us, in a structured, commonly used and machine-readable format so you can transmit this personal information to another entity.
Right to object:
- Under certain circumstances, as provided by applicable law, you have the right to object, on grounds relating to your specific situation, at any time to the processing of your personal information by us and we are required to no longer process your personal information.
- If you have a right to object and if you exercise this right, your personal information will no longer be processed for such purposes by us unless we demonstrate compelling legitimate grounds or such other grounds or exceptions (as applicable) pursuant to applicable law. You may exercise this right by contacting us as stated in Section VII below.
- This is not an absolute right and does not apply in certain situations or in every jurisdiction, such as when processing is necessary to perform the employment or services contract, to comply with applicable law, or to defend legal claims.
Right to Lodge a Complaint: You may also have the right to lodge a complaint with the competent government or supervisory authority.

V. Protecting Your Information

We take reasonable and industry standard efforts to protect personal information (such as from unauthorized access, use, loss, and disclosures) taking into consideration the state of the art technology, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risk of processing your personal information. While we strive to protect your personal information, we cannot ensure the security of the information you transmit to us, and so we urge you to take every precaution to protect your personal data when you are on the Internet.

VI. Other Important Information

Your Obligations. You are solely responsible for (a) providing and maintaining complete and accurate information in your application, account, resume, CV, cover letters, and any other recruiting documents and processes, (b) ensuring that the information you submit does not violate any third party’s rights, (c) keeping your personal information on file with us up to date, (d) informing us of any significant changes to your information, (e) maintaining the security and confidentiality of your access and login credentials, and (f) notifying us promptly and without undue delay when you become aware of any loss or compromise to your access credentials or accounts.
Third Party References and Services. This Notice does not address, and we are not responsible for, the practices of any third parties including any third-party websites, apps, products, or services. Such third parties and their websites, apps, products, or services have their own policies, rules, and practices for how they collect and use your personal information. Please review each such third party’s privacy policies, statements, and notices to learn more about how they handled your personal information. Any links to third party websites, apps, products, or services provided in our job and recruitment websites or any documentation or materials we provide to you are not endorsements and should not be relied upon as such.
Changes to this Notice. We may change this Notice at any time. When we do, we’ll let you know by revising the date at the top of this Notice. We may also provide you with additional notice (such as adding a statement to our websites’ homepages or adding “Updated” to the footer links to this Notice (e.g., Updated CCPA Privacy Statement and Job Applicant Privacy Notice). The “Effective Date” heading at the top of this Notice indicates when it was last revised. Any changes will become effective when we post the revised notice on our job and recruitment websites, or any other websites that link to this Notice, or when we furnish it to you in writing (such as via email, our intranet, or mail), whichever is earlier. You are solely responsible for periodically reviewing our job and recruitment websites and any notices we send to you including any updates or changes to this Notice posted or otherwise provided to you to ensure you are aware of changes and our current privacy practices.
Adults Only. Our job and recruitment websites and services are not intended for minors under the age of 18 or the age of majority in your place of residency.

VII. Contact Information and Questions

If you have any questions or comments about this Notice and the ways in which we collect and uses your personal information as described above, please do not hesitate to contact our People Ops team at peopleops@mediaalpha.com.